Edit the registry on a mounted WIM


This is an incredibly valuable task.  Windows Vista employs “Image Based Setup”, meaning their is no more i386 folder.  Instead, Windows now comes on the DVD as an image that is copied and expanded during setup.  An admin can capture a custom .WIM windows image and mount the WIM to add/modify/remove files.  Did you know you can also edit the registry?

Mount the WIM file to a local folder using ImageX.

C:\ImageX>imagex /mountrw install.wim 1 c:\mount

ImageX Tool for Windows
Copyright (C) Microsoft Corp. 1981-2005. All rights reserved.

Mounting (RW): [C:\ImageX\install.wim, 1] ->
[c:\mount]

Successfully mounted image (RW).

Load the registry hive you need.  In this case let’s mount HKLM\Software.

C:\mount>reg load HKLM\test c:\mount\windows\system32\config\software

The operation completed successfully.

Open Regedit to make changes or use Reg Add from the command line.

RegEdit with software hive loaded as

Unload the reg hive.

C:\Windows\system32>reg unload HKLM\test

The operation completed successfully.

Unmount the image.

C:\ImageX>imagex /unmount /commit c:\mount

ImageX Tool for Windows
Copyright (C) Microsoft Corp. 1981-2005. All rights reserved.

Unmounting: [c:\mount]…

Successfully unmounted image.

It really is that simple.  Changes to be made without having to apply, sysprep, and recapture the image.  You could leverage this as a tool in a variety of ways such as to embed a script to run application installations after the image has been deployed, automate activation using slmgr.vbs, etc.


Comments (15)

  1. Anonymous says:

    How to load User Hive ?

    I would like to modify Default User Settings.

  2. Dimo says:

    I don’t have the mount command in windows xp.

    Where do I get it?

    I can do the rest of the things but when I run mount>reg mount is not recognized command.

    Thank you.

  3. JP says:

    Dimo:  You need to install Imagex.  Google "Imagex" or search on Microsoft’s site.  An alternative is Gimagex which is a GUI-based frontend for imagex developed by a third party.  Imagex is command-line based and is what you need to run the commands shown in this article.

  4. world free says:

    it should be noted that when using imagex that you must select the correct index to modify containing the correct version of Vista (ex. Business, Ultimate, etc.).  this is the "1" in "C:ImageX>imagex /mountrw install.wim 1 c:mount".  you can find the correct index number by doing a "imagex /info install.wim" and noting the index number in the report.

  5. Brian Reich says:

    JP,

    You need to download the Windows Automated Installation Kit to get imagex, peimg, and the rest of the command-line tools.

  6. Mike Targgart says:

    I tried following this exactly, but kept getting an "Access Denied" error. For some reason the /mountrw switch isn't allowing me to even load the reg hive. I've looked all over the internet for a solution, but found nothing. I can manually go through the folders and change the permissions on things, but can't do it through the cmd line.

    Any ideas?

  7. ML49448 says:

    Make sure wimgapi.dll is registered.

  8. Tuong says:

    I have same question with Mike

    And I do like Michael said but it not work

    Keep "Acess is denied"

    Please help me

  9. User77 says:

    You must close the registry editor – then it works.

  10. Tausif Farid says:

    For those facing  "Acess is denied" you must have to type the "test" word as it is showing in the given command, i have type the test word in caps ON :

    C:mount>reg load HKLMTEST c:mountwindowssystem32configsoftware

  11. Passer-by says:

    Marcus..

    For XP use

    REG LOAD HKLMDefUsr "c:documents and settingsdefaultntuser.dat"

    For Windows Vista and up use…

    REG LOAD HKLMDefUsr "c:usersdefaultntuser.dat"

    When you're done editing use (All windows versions)…

    REG UNLOAD HKLMDefUsr

    HTH. Shaun.

  12. Netanel says:

    Holycrap! I realize this is from 2006 but, you just saved me hours of work! THANK YOU!
    works perfectly with a Windows 7 pro image. mount image, load registry, make changes, unload registry, commit and unmount.

  13. vincent says:

    unbelievable!! 🙂
    It work for me with after a disk2vhd from win2k8R2 physical server to hyper-v2012 R2 VM
    Thanks

  14. Tony4219 says:

    This helped tremendously !!!!!!! Many thanks here in 2015. I’ll try to post some info:

    research: Steps needed to increase X: scratchspace using registry hack.

    3/7/15 found Michael Green info about editing registry on a mounted hive (YESSSSS!) and
    combined info from joakim and M.Green. This used Winbuilder [080] Win7PESE x64:

    1) Before running WINB from usbstick, copy boot.wim to host hard drive for speed
    2) then, in running WINB, run GimageX, (I have GimageX script in my build)
    3) Pick mountpoint, like d:n which must pre-exist. Drive letter could be C: D: E: etc. Be careful!
    4) Use path to WIM= d:boot.wim where I copied to host drive (instead of running all from usbstick)
    5) MOUNT for read/write — at this point, we did the equivalent of first half of M.Green paper
    6) then, I opened cmdprompt in WINB,
    7) navigated to x:windowssystem32 (where all DISM files are)
    8) and ran M.Green command to load reg hive you want to ‘test’, **BUT** used the path specified by

    joakim, for SYSTEM, and the mountpoint of your choosing:
    9) so, in cmdprompt in x:windowssystem32 type: reg load HKLMtest d:nwindowssystem32configsystem
    10) and you get "The operation completed successfully."
    11) Back to M.Green: open Regedit in running WINB and make changes to joakim-specified KEY:
    HKEY_LOCAL_MACHINESYSTEMControlSet001ServicesFBWF and change value WinPECacheThreshold
    [ Note: the mounted hive in your regedit has a pathname like:
    ComputerHKEY_LOCAL_MACHINEtestControlSet001ServicesFBWF ]
    12) make WinPECacheThreshold 400(hex) which also shows as 1024(dec).
    see screenshot. It might be set to only 80 (hex) which shows as 128 (dec).
    13) Exit Regedit.
    14) Go back to the still-open cmdprompt which is still at x:windowssystem32 and type:
    15) reg unload HKLMtest
    16) and see "The operation completed successfully."
    17) close the cmdprompt
    18) Go back to GimageX
    19) in GimageX, go to Capture tab. select as SOURCE folder d:n which contains the WIM and

    20) chose DESTINATION a new full path like d:boot2.wim.
    21) Mark checkbox for BOOT. Otherwise you will get winload error and it won’t boot.
    22) Leave default setting of Fast compression.
    23) click CREATE. Wait about 10 mins to create new WIM. See the different file size this time.
    24) do UNMOUNT of WIM, on the Mount tab
    25) copied boot2.wim and put it on Y:sources and renamed to boot.wim.
    Use COPY, not MOVE. MOVE took a really long time before lockup error "file was open in SYSTEM"
    26) reboot the usbstick to see changes.

    WORKS! 954MB free of 956MB on X:. Ramdisk on B: still 3.18GB on 8GB RAM laptop.